Topic starter
18/08/2026 2:33 pm
TL;DR: AI speeds COBOL translation and test generation, but the bottleneck is verifying that output preserves business logic and control integrity, according to Sonar. Deterministic analysis must gate load-bearing code before release.
Editorial analysis by NHI Mgmt Group, based on content published by Sonar: “COBOL is back, and AI is writing it. Who's verifying the code?”.
By the numbers:
- roughly 220 billion lines of code still run in production, according to Reuters reporting cited by Sonar.
Key questions
Q: Why does AI-assisted modernisation create verification risk in legacy systems?
A: Because AI can generate code faster than expert reviewers can validate it, especially when the original maintainers are retiring.
Q: What breaks when expert COBOL reviewers are no longer available?
A: The safety net breaks first.
Q: How should teams govern AI-generated COBOL before it reaches production?
A: Treat AI-generated COBOL as draft material until it clears the same deterministic checks as human-written code.
Practitioner guidance
- Implement deterministic quality gates for AI-generated COBOL Run translated or refactored COBOL through the same static analysis and policy checks used for human-written code before merge or release.
- Prioritise behavioural equivalence checks over syntax review Validate branch handling, embedded SQL, and edge-case logic so the translated program preserves the original outcome, not just the same structure.
- Separate AI drafting from final approval Use AI for comprehension and first-pass translation, but require a reviewer or control layer that is independent of the generation step.
Bottom line: AI speeds COBOL transformation work, but it also increases the amount of code that must be trusted faster than human reviewers can validate it.
Glossary terms: Verification debt, Deterministic program analysis, Behavioral Equivalence, Control Integrity
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
18/08/2026 3:20 pm
Verification debt is the real risk introduced by AI in COBOL modernisation. The article is correctly framed around a review bottleneck, not a generation bottleneck, because AI increases the amount of code that must be trusted faster than the human expertise base can absorb it. In governance terms, this is a control capacity problem: the organisation can produce transformation output faster than it can establish confidence in that output. The practitioner conclusion is that verification design now matters as much as modernization intent.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between code generation and code verification in AI pipelines?
A: Code generation produces a plausible implementation, while code verification determines whether that implementation is trustworthy enough to merge and ship. In AI pipelines, the distinction matters because the tool that writes code is not the same control that proves the code is safe, maintainable, and ready for production.
👉 Read our full editorial: AI-assisted COBOL modernization depends on verification, not generation